38 lines
1.0 KiB
Desktop File
38 lines
1.0 KiB
Desktop File
[Unit]
|
|
Description=ferrix_bgp teaching BGP speaker
|
|
After=network-online.target bird.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
ExecStart=/usr/local/bin/ferrix-bgp /etc/ferrix-bgp/ferrix.textpb --level info
|
|
# SIGTERM makes ferrix send Cease / Administrative Shutdown to BIRD first.
|
|
KillSignal=SIGTERM
|
|
TimeoutStopSec=10
|
|
Restart=on-failure
|
|
RestartSec=5
|
|
|
|
# It needs the network and nothing else: no root, no privileged port, no
|
|
# write access anywhere. The one capability, CAP_NET_RAW, is for the ping
|
|
# monitor's raw ICMPv6 socket; drop both lines if ping_monitor is not
|
|
# configured.
|
|
DynamicUser=yes
|
|
NoNewPrivileges=yes
|
|
ProtectSystem=strict
|
|
ProtectHome=yes
|
|
PrivateTmp=yes
|
|
PrivateDevices=yes
|
|
ProtectKernelTunables=yes
|
|
ProtectKernelModules=yes
|
|
ProtectControlGroups=yes
|
|
RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
|
|
RestrictNamespaces=yes
|
|
LockPersonality=yes
|
|
MemoryDenyWriteExecute=yes
|
|
SystemCallArchitectures=native
|
|
AmbientCapabilities=CAP_NET_RAW
|
|
CapabilityBoundingSet=CAP_NET_RAW
|
|
MemoryMax=256M
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|